attachment
<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class="">
<div><br class=""><blockquote type="cite" class=""><div class="">On Mar 4, 2019, at 11:14 AM, Michael Sweet <<a href="mailto:msweet@apple.com" class="">msweet@apple.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Smith,</span><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""><div class=""><blockquote type="cite" class=""><div class="">On Mar 4, 2019, at 12:22 PM, Kennedy, Smith (Wireless & Standards Architect) via ipp <<a href="mailto:ipp@pwg.org" class="">ipp@pwg.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Greetings,<div class=""><br class=""></div><div class="">Thanks to all who provided feedback on the 20190117 draft of IPP Authentication Methods. Since I received valuable non-editorial feedback in addition to editorial feedback on the draft from the PWG Last Call, I have produced a new revision that hopefully resolves all the issues and can be used in a second last call. The new draft is here:</div><div class=""><br class=""></div><div class=""> <a href="https://protect-us.mimecast.com/s/D3aXC1wq8qiGREkwuL5aci?domain=ftp.pwg.org" class="">https://ftp.pwg.org/pub/pwg/ipp/wd/wd-ippauth-20190304.odt</a> </div><div class=""> <a href="https://protect-us.mimecast.com/s/zuXzC2kr5rf3jERoI1JDrB?domain=ftp.pwg.org" class="">https://ftp.pwg.org/pub/pwg/ipp/wd/wd-ippauth-20190304.pdf</a> </div><div class=""> <a href="https://protect-us.mimecast.com/s/u2zDC31v5viKBRGYI21Si0?domain=ftp.pwg.org" class="">https://ftp.pwg.org/pub/pwg/ipp/wd/wd-ippauth-20190304-rev.odt</a> </div><div class=""> <a href="https://protect-us.mimecast.com/s/wmRLC4xw7wu5o7mAuWGutv?domain=ftp.pwg.org" class="">https://ftp.pwg.org/pub/pwg/ipp/wd/wd-ippauth-20190304-rev.pdf</a> </div><div class=""><br class=""></div><div class="">I included the contents of my LCRC document in the "Change History" section. If those that submitted comments could review this draft offline and evaluate whether my changes have fixed their issues, I'd appreciate it.</div></div></div></blockquote></div><div class=""><br class=""></div>The -rev version is (as usual) a bit hard to follow, but I like the changes.</div></div></blockquote><div><br class=""></div><div>Totally agree!</div><div><br class=""></div><div><a href="https://bugs.documentfoundation.org/show_bug.cgi?id=123848" class="">https://bugs.documentfoundation.org/show_bug.cgi?id=123848</a></div><div><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"> We normally do the LCRC comments in a separate txt file, but I'm fine with it being in the changes section for now. Process/3.0 doesn't require a particular format or filename, just that all comments and their resolutions be listed for review.</div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">Feedback:</div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">One addition I'd like to see to see for the "requesting-user-name" method is a note that some Clients use a constant identity as a privacy defense (e.g., "mobile" from iOS Clients) when sending requests, so from a Printer's perspective this method is basically useless. In the context of GDPR, this falls under a need for explicit consent - a password challenge or Client UI requesting permission to provide the real user name is required. At Apple we decided to always hide the requesting user on iOS for basic privacy reasons, relying on authentication where such information is genuinely needed.</div></div></blockquote><div><br class=""></div>Do you want this in section 4.2 "The 'requesting-user-name' IPP Authentication Method" (using numbering from the non-rev documents), or in 5.1.1. "General Recommendations" (for Clients), or 7.2. "Client Security Considerations"? There seems to be two different statements: what is done in the field, and what a Client or Printer ought to do.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">In the general client recommendations (section 14.2?), you say:</div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"> Client security considerations (section 18.2) should also be followed.</div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">Since we have a lowercase "should" here, perhaps reword this as:</div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"> Also see section 18.2 for Client security considerations and recommendations.<br class=""></div></div></blockquote><div><br class=""></div>OK. Will fix that now and re-post once I am clear about what to do about the "anonymized 'requesting-user-name'" issue above and where it should live.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div class=""><br class=""></div><div class="">There is a similar statement in the general printer recommendation (section 14.4?), which should probably read "Also see section 18.4 for Printer security considerations and recommendations." (right now it says Client...)</div></div></div></blockquote><div><br class=""></div>Will fix that one too.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div class=""><br class=""></div><div class=""><span class="Apple-style-span" style="border-collapse: separate; font-family: "Andale Mono"; font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; line-height: normal; border-spacing: 0px; -webkit-text-decorations-in-effect: none;"><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><span class="Apple-style-span" style="border-collapse: separate; font-family: "Andale Mono"; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-stroke-width: 0px;"><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">_________________________________________________________<br class="">Michael Sweet, Senior Printing System Engineer</div></span></div></span></div></div></div></blockquote></div><br class=""></body></html>